CVE-2024-4032

Incorrect classification of IPv4/IPv6 addresses in the ipaddress module.

• CVSS 7.5
• CWE-697
• Design Defects
• Local

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.

CVE

CVE-2024-4032

CWE

CWE-697

CVSS base score

7.5

Published

2024-06-17

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Vulnerable and Outdated Components

Accessibility scope

Local

Impact

Unauthorized Access

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade to CPython 3.12.4 or 3.13.0a6.

import ipaddress

private_ip = ipaddress.IPv4Address('10.0.0.1')
global_ip = ipaddress.IPv4Address('8.8.8.8')

print(f"{private_ip} is private: {private_ip.is_private}")
print(f"{global_ip} is global: {global_ip.is_global}")    

private_ipv6 = ipaddress.IPv6Address('fd00::1') 
global_ipv6 = ipaddress.IPv6Address('2001:4860:4860::8888') 

print(f"{private_ipv6} is private: {private_ipv6.is_private}")
print(f"{global_ipv6} is global: {global_ipv6.is_global}")

import ipaddress

def check_ip(ip_str):
    try:
        ip = ipaddress.ip_address(ip_str)
        if isinstance(ip, ipaddress.IPv4Address):
            print(f"{ip} is private: {ip.is_private}")
            print(f"{ip} is global: {ip.is_global}")
        elif isinstance(ip, ipaddress.IPv6Address):
            print(f"{ip} is private: {ip.is_private}")
            print(f"{ip} is global: {ip.is_global}")
    except ValueError:
        print(f"Invalid IP address: {ip_str}")

check_ip('10.0.0.1')
check_ip('8.8.8.8')
check_ip('fd00::1')
check_ip('2001:4860:4860::8888')

import ipaddress

# Example of potentially misleading address classifications
misleading_ip = ipaddress.IPv4Address('192.168.1.1')  # Typically a private address
misleading_ipv6 = ipaddress.IPv6Address('::1')         # Loopback address, typically not global

# Attempt to check if they are private or global
print(f"{misleading_ip} is private: {misleading_ip.is_private}")  # Could return False in a vulnerable state
print(f"{misleading_ip} is global: {misleading_ip.is_global}")    # Could return True in a vulnerable state

print(f"{misleading_ipv6} is private: {misleading_ipv6.is_private}")  # Could return False in a vulnerable state
print(f"{misleading_ipv6} is global: {misleading_ipv6.is_global}")    # Could return True in a vulnerable state

@misc{vaitp:cve20244032,
  title        = {{Incorrect classification of IPv4/IPv6 addresses in the ipaddress module.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-4032},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-4032/}}
}